Georgia’s voting machines recorded votes properly – but they have hacking vulnerabilities that went undiscovered for years. The findings are from a recent review of the voting machines and represent a mixed bag for people concerned about foreign and domestic interference in U.S. elections. First, the good news: There’s no evidence any of the vulnerabilities have been used to alter votes in any elections, as my colleagues Ellen Nakashima and Amy Gardner report. Most of the vulnerabilities are also quite difficult to exploit, requiring hands-on access to the voting machines. And they’re likely to be caught by standard security protocols in election offices. But: The vulnerabilities in the Dominion Voting Systems-brand machines remained undetected for years. They might not have been discovered now if not for a long-running lawsuit over the security of Georgia’s machines during which University of Michigan computer scientist J. Alex Halderman was given a chance to examine the machines on behalf of the plaintiffs in the case. Such independent reviews are still relatively rare — and election security advocates warn vulnerabilities in other voting systems could still be waiting out there undiscovered. Halderman’s findings were verified by the Cybersecurity and Infrastructure Security Agency (CISA), which is in the process of notifying more than a dozen states that use the machines about the vulnerabilities and mitigation measures they should take, according to Ellen and Amy who got an advance look at the CISA advisory.
National: Cyber agency: No evidence the flaws in the Dominion Voting Systems’ equipment have been exploited to alter election results | Kate Brumback/Associated Press
Electronic voting machines from a leading vendor used in at least 16 states have software vulnerabilities that leave them susceptible to hacking if unaddressed, the nation’s leading cybersecurity agency says in an advisory sent to state election officials. The U.S. Cybersecurity and Infrastructure Agency, or CISA, said there is no evidence the flaws in the Dominion Voting Systems’ equipment have been exploited to alter election results. The advisory is based on testing by a prominent computer scientist and expert witness in a long-running lawsuit that is unrelated to false allegations of a stolen election pushed by former President Donald Trump after his 2020 election loss. The advisory, obtained by The Associated Press in advance of its expected Friday release, details nine vulnerabilities and suggests protective measures to prevent or detect their exploitation. Amid a swirl of misinformation and disinformation about elections, CISA seems to be trying to walk a line between not alarming the public and stressing the need for election officials to take action. CISA Executive Director Brandon Wales said in a statement that “states’ standard election security procedures would detect exploitation of these vulnerabilities and in many cases would prevent attempts entirely.” Yet the advisory seems to suggest states aren’t doing enough. It urges prompt mitigation measures, including both continued and enhanced “defensive measures to reduce the risk of exploitation of these vulnerabilities.” Those measures need to be applied ahead of every election, the advisory says, and it’s clear that’s not happening in all of the states that use the machines.
Source: Cyber agency: Voting software vulnerable in some states | AP News